Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

MISP — Vulnerabilities & Security Advisories 183

Browse all 183 CVE security advisories affecting MISP. AI-powered Chinese analysis, POCs, and references for each vulnerability.

MISP is an open-source threat intelligence platform designed for sharing cyber threat information between organizations. Historically, vulnerabilities in MISP have included remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from improper input validation or access control issues. The platform's security characteristics emphasize collaborative information sharing, though past incidents have highlighted risks in default configurations and plugin vulnerabilities. With 9 CVEs on record, MISP remains widely adopted for threat intelligence sharing, requiring proper hardening and regular updates to mitigate potential exploitation risks. Organizations should implement strict access controls and validate all shared data to prevent misuse.

CVE ID Title CVSS Severity Published
CVE-2026-86440 MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs — MISP CWE-79 5.1 Medium 2026-09-07
CVE-2026-86419 MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery — MISP CWE-918 7.0 High 2026-09-07
CVE-2026-86418 MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users — MISP CWE-200 2.3 Low 2026-09-07
CVE-2026-86417 MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users — MISP CWE-200 5.3 Medium 2026-09-07
CVE-2026-86408 MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events — MISP CWE-862 7.1 High 2026-09-07
CVE-2026-86351 MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL — MISP CWE-601 5.1 Medium 2026-09-07
CVE-2026-86347 MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion — MISP CWE-862 7.1 High 2026-09-07
CVE-2026-86342 MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information — MISP CWE-862 5.3 Medium 2026-09-07
CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data — MISP CWE-862 7.1 High 2026-09-06
CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP — misp CWE-352 6.2 Medium 2026-09-04
CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests — misp CWE-352 8.6 High 2026-09-04
CVE-2026-85538 MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes — misp CWE-863 8.3 High 2026-09-04
CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter — misp CWE-862 7.6 High 2026-09-04
CVE-2026-85239 MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service — misp CWE-20 7.1 High 2026-09-03
CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking — misp CWE-384 7.6 High 2026-09-03
CVE-2026-85237 Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass — misp CWE-307 8.6 High 2026-09-03
CVE-2026-85236 MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request — misp CWE-352 8.8 High 2026-09-03
CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection — misp CWE-79 5.3 Medium 2026-09-03
CVE-2026-85227 Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters — misp CWE-79 6.1 Medium 2026-09-03
CVE-2026-85226 MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations — misp CWE-862 5.3 Medium 2026-09-03
CVE-2026-85221 MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks — misp CWE-295 7.6 High 2026-09-03
CVE-2026-85216 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials — misp CWE-521 9.5 Critical 2026-09-03
CVE-2026-77761 Cross-Document Parser State Contamination in misp-stix — misp-stix CWE-459 6.3 Medium 2026-08-21
CVE-2026-77755 Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library — misp-stix CWE-400 8.7 High 2026-08-21
CVE-2026-77751 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library — misp-stix CWE-22 8.8 High 2026-08-21
CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library — misp-stix CWE-20 6.9 Medium 2026-08-21
CVE-2026-73162 cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes — cti-transmute CWE-352 5.3 Medium 2026-08-11
CVE-2026-73161 cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting — cti-transmute CWE-79 5.1 Medium 2026-08-11
CVE-2026-73160 cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses — cti-transmute CWE-918 8.7 High 2026-08-11
CVE-2026-73159 cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface — cti-transmute CWE-79 5.1 Medium 2026-08-11

This page lists every published CVE security advisory associated with MISP. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.